Where Woof — Toolchain
Everything used to build and run the project, with where it fits.
Product stack (public site — "GOAT")
| Tool |
Version |
Used for |
| Go |
1.26 |
Frontend: stdlib net/http (no framework), html/template, Go 1.22+ ServeMux routing |
| HTMX |
1.9.12 |
Inline editing, account panel swaps, contact forms (no page reloads) |
| Alpine.js |
3.x |
Live phone validation, small client behaviours |
| Tailwind CSS |
CDN |
Utility-first styling (swap to a build step in Phase 3 polish later) |
| Postgres |
16 |
Single shared database (wherewoof-db on .13) |
| pgx |
v5 |
Postgres driver + pool for Go |
| sqlc |
1.31.1 |
Type-safe query generation from SQL (compiled-checked queries) |
| gorilla/sessions |
— |
Signed cookie sessions |
| bcrypt |
— |
Password hashing |
Admin stack
| Tool |
Version |
Used for |
| Laravel |
13 (PHP 8.3) |
Admin backend; Eloquent reads the shared Postgres schema |
| Filament |
v3 |
Admin panel UI: CRUD resources (User/Tag/Product/Order), dashboard widgets |
| Livewire |
(Filament dep) |
Reactive admin pages |
| Docker |
— |
Laravel dev (.27:3030) + prod (.13:3031); Postgres container |
Infrastructure & deployment
| Tool |
Role |
| NixOS |
.27/.13/.51 hosts; systemd user services; firewall via config |
| systemd |
where-woof.service (frontend, auto-restart, linger) |
| Docker Compose |
Postgres, admin, other services |
| Caddy |
Reverse proxy + TLS on .35 (public domains) |
| Pi-hole |
Local DNS (.home.lab domains) |
| rsync |
Deploy artifacts to .13 |
| Gitea |
Git hosting (sam/where_woof) |
SMS
| Tool |
Role |
| SMSGlobal HTTP API |
Live SMS (api.smsglobal.com/http-api.php, action=sendsms) — verified number as sender |
internal/sms (Go) |
Swappable Sender interface: LogSender (dev), HTTPClient (live), smsglobal REST client (unused fallback) |
Development workflow
| Tool |
Role |
| OpenSpec |
Spec-driven development: openspec/changes/* (proposal → design → specs → tasks), validated |
| plannotator |
Plan review (browser UI) for the first two phases |
| pi subagents |
Master/worker delegation: database, coder-pro, code-analysis, devops |
| Makefile |
db-up, seed, seed-registry, run, build, generate, psql |
| Verify suites |
/tmp/verify.sh (22 checks), verify2.sh (19), verify3.sh (12) — HTTP-level regression tests |
Security tooling (guards package installs)
SafeDep Vet (vet), npq (typosquatting), Socket Firewall (socket) — the npm-security skill wraps installs.
Notes / gotchas (hard-won)
- Filament v3: production 403 unless the User model implements
FilamentUser.
- Behind Caddy, force
URL::forceScheme('https') to avoid mixed-content asset blocks.
- sqlc: nullable columns →
pgtype.*; explicit INSERT column lists must include new columns.
- NixOS:
CGO_ENABLED=0 for Go builds (no gcc); make via nix profile; psql via docker exec.
- Admin files created by Docker are root-owned — edit via
docker cp.
